JP5575950B2 - Wireless terminal device and system protection method - Google Patents

Description

  The present invention relates to a wireless terminal device such as a mobile phone. More specifically, the present invention protects system resources of a wireless terminal device from a malicious code attack in a wireless environment and ensures a safe security service. The present invention relates to a wireless terminal device and a system protection method.

  Generally, a wireless terminal device such as a mobile phone provides various information services in a wireless environment.

FIG. 1 is a block diagram illustrating a configuration of a conventional wireless terminal device.
As shown in FIG. 1, the conventional wireless terminal device includes a domain unit 10 having an operating system (OS) 11 and an application 12, ROM (ROM), central processing unit (CPU), memory, battery, input A system resource unit 20 including an output device (I / O device) and the like is included. In such a conventional wireless terminal device, an application 12 including voice call, bank banking, electronic commerce (trading), digital rights management (DRM) and the like is driven by one operating system 11. .

  However, in the conventional wireless terminal device as described above, since all applications 12 operate on one operating system 11 regardless of the degree of security, malicious software is installed in the wireless terminal device without the user's knowledge in a wireless environment. In this case, the wireless data information and system resources of the wireless terminal device cannot be protected from malicious code attacks, and a safe security service cannot be guaranteed.

  More specifically, the malicious code depletes the battery of the wireless terminal device, making it impossible to use important services. After receiving a message such as SMS / MMS that contains the malicious code, the entire system at the time of message execution is damaged. Therefore, there is a problem of hindering the availability of the wireless terminal device.

In addition, when operations such as encryption and decryption are performed in the memory of the wireless terminal device, since the malicious code can monitor the memory contents before the encryption and decryption are performed, confidential user data is leaked. There is a problem to do.
Korean Published Patent No. 2002-032757 Korean Published Patent No. 2003-039665 Korean Published Patent No. 2004-086333 Japanese Published Patent No. 2003-091429 Japanese Published Patent No. 2004-038819 US Pat. No. 7,020,738

  The present invention has been devised to solve the above-described points, and can protect system resources of a wireless terminal device from malicious code attacks in a wireless environment and ensure a safe security service. The present invention relates to a wireless terminal device and a system protection method.

  The objects of the present invention are not limited to the objects mentioned above, and other objects not mentioned will be clearly understood by those skilled in the art from the following description.

  In order to achieve the above object, a wireless terminal according to an embodiment of the present invention is divided into a first domain that drives a first application that requires safety and the first domain, and is vulnerable to security. A domain unit including a second domain that drives the second application, a system resource unit configuring hardware of the wireless terminal device, and a control unit that controls an approach operation of the domain unit with respect to the system resource unit.

  In order to achieve the other object, a system protection method for a wireless terminal apparatus according to an embodiment of the present invention is divided into a first domain that drives an application requiring safety (a) and is vulnerable to security. Calculating the current battery usage amount of the second domain and the current battery residual amount of the wireless terminal device for driving a general application, (b) the current battery residual amount of the wireless terminal device calculated in the step (a) Is less than a minimum reference value for stably driving an important service, the step of interrupting the driving of the second domain, and (c) the current battery remaining amount of the wireless terminal device in step (b) is If the current battery usage of the second domain is equal to or greater than the maximum reference value, the CPU usage of the second domain is gradually reduced. Including the step of.

  Specific matters of other embodiments are included in the detailed description and the drawings.

  According to the wireless terminal device and system protection method of the present invention as described above, there are one or more of the following effects.

  By first distinguishing the operating system in which a safe application that must be protected from malicious code attacks is executed from a general application that is vulnerable to security, the security of the wireless terminal device can be improved.

  Second, it is possible to increase the usefulness of the wireless terminal device by preventing system resources of the wireless terminal device, for example, battery consumption, from being attacked by malicious codes.

  Third, by performing encryption and decryption on important data information of the wireless terminal device, it is possible to improve confidentiality of the important data information.

  Fourth, by backing up important data information of the operating system in which the general application is executed, it is possible to prevent the important data information from being deleted or transformed by executing malicious code included in the general application. it can.

  The effects of the present invention are not limited to the effects mentioned above, and other effects which are not mentioned will be clearly understood by those skilled in the art from the claims.

It is the block diagram which illustrated the structure of the conventional radio | wireless terminal apparatus. 1 is a block diagram illustrating a configuration of a wireless terminal device according to an embodiment of the present invention. 5 is a flowchart illustrating a processing method for a malicious code battery attack of a wireless terminal device according to an exemplary embodiment of the present invention. 5 is a flowchart for explaining an encryption / decryption processing method of a wireless terminal device according to an embodiment of the present invention; 5 is a flowchart for explaining an SMS / MMS data backup processing method of a wireless terminal device according to an embodiment of the present invention;

  Advantages and features of the present invention and methods of achieving them will be apparent with reference to the embodiments described in detail below in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, and can be embodied in various forms different from each other. The present embodiments merely complete the disclosure of the present invention and the technology to which the present invention belongs. It is provided to fully inform those skilled in the art of the scope of the invention and is defined only by the scope of the claims. Like reference numerals refer to like elements throughout the specification.

  Hereinafter, a wireless terminal device and a system protection method according to preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. When it is determined that a specific description of a known function or configuration related to the description of the present invention for reference may obscure the gist of the present invention, a detailed description thereof will be omitted.

FIG. 2 is a block diagram illustrating a configuration of a wireless terminal device according to an embodiment of the present invention.
As shown in FIG. 2, the wireless terminal apparatus according to an embodiment of the present invention includes a domain unit 100, a system resource unit 200, a control unit 300, and the like.

  The domain unit 100 means an environment in which a corresponding application operates according to each operating system (OS). The domain unit 100 includes first, second, and third domains 110, 120, and 130.

  The first domain 110 downloads and installs a first application 111 that requires safety from an authenticated wireless Internet server, and causes the first operating system (OS1) 112 to execute the first application 111. The first application 111 includes an application for providing services such as voice call, bank banking, electronic commerce, and digital rights management (DRM).

  The second domain 120 is separated from the first domain 110, and the second operating system (OS2) is installed by downloading and installing a second application 121 that is somewhat weak in security and may be attacked by malicious code from a general wireless Internet server. ) 122, the second application 121 is executed. The second application 121 includes an application for providing services such as SMS / MMS and User APP.

  The third domain 130 is separated from the first and second domains 110 and 120, and important data information is prevented from being deleted or transformed by executing malicious code included in the second application 121 in the second domain 120. Therefore, the important data information of the second domain 120 is backed up. In the third domain 130, the backup data information is not executed and only the backup storage function is performed so as to minimize the damage to the SMS / MMS system including the malicious code.

  The system resource unit 200 constitutes hardware of a wireless terminal device. The system resource unit 200 includes a ROM (ROM) 210, a central processing unit (CPU) 220, a memory 230, a battery 240, an input / output device (I / O device) 250, and the like. Here, the ROM 210 is a storage area that cannot be illegally changed by the user or the system. The memory 230 includes a non-volatile memory such as a flash memory as a storage for storing wireless data information. The memory is divided into a plurality of storage areas so that various types of wireless data can be classified and stored according to type and security, and important data information is encrypted and stored in a predetermined storage area among the storage areas. Is preferred.

  The controller 300 uses a virtual machine monitor (VMM) to control the operation so that the domain unit 100 can access the system resource unit 200. The control unit 300 includes an access control module 310 and an encryption module 320 to protect the system resource unit 200.

  The access control module 310 controls an approach operation of the second domain 120 to the system resource unit 200 in order to cope with a malicious code attack on the system resource unit 200. For example, when a malicious code included in the second application 121 of the second domain 120 attacks the battery 240 in the system resource unit 200, the access control module 310 may stabilize the important service with the current battery remaining amount of the wireless terminal device. If it is below the minimum reference value for driving the second domain 120, the driving of the second domain 120 is interrupted. If the current battery residual amount of the wireless terminal device is equal to or greater than the minimum reference value, but the current battery usage amount of the second domain 120 is equal to or greater than the maximum reference value, the CPU usage amount of the second domain 120 is gradually decreased. . Here, the minimum reference value and the maximum reference value are reference values defined in advance when the wireless terminal system is set.

  The encryption module 320 encrypts and decrypts important data information input from the first and second domains 110 and 120 to the system resource unit 200. For example, when the wireless terminal device does not support the hardware-like encryption association function, the encryption module 320 uses the VMM to perform encryption, decryption, electronic signature, etc. on the important data information. .

  Hereinafter, a system protection method for a wireless terminal apparatus according to an embodiment of the present invention will be described in detail with reference to FIGS.

FIG. 3 is a flowchart for explaining a processing method for a malicious code battery attack of a wireless terminal device according to an embodiment of the present invention.
As shown in FIG. 3, when the battery 240 of the wireless terminal device is attacked by a malicious code, the present invention manages the corresponding domain to ensure the availability of the battery 240.

  More specifically, when the malicious code included in the second application 121 of the second domain 120 attacks the battery 240 in the system resource unit 200, the current battery usage of the second domain 120 and the current battery of the wireless terminal device Each remaining amount is calculated (S101). Next, if the calculated current battery remaining amount of the wireless terminal device is equal to or less than the minimum reference value for stably driving the important service (S102), the driving of the second domain 120 is interrupted (S103), The user is notified of the malicious code battery 240 attack (S104). Next, if the current battery residual amount of the wireless terminal device is equal to or greater than the minimum reference value, but the current battery usage amount of the second domain 120 is equal to or greater than the maximum reference value (S105), the CPU usage amount of the second domain 120 Is gradually reduced to maintain the battery usage of the second domain 120 at the maximum reference value limit (S106). Here, the battery consumption is closely related to the CPU usage.

  FIG. 4 is a flowchart for explaining an encryption / decryption processing method of a wireless terminal device according to an embodiment of the present invention.

  As shown in FIG. 4, the present invention encrypts and decrypts important data information input from the first and second domains 110 and 120 to the system resource unit 200 constituting the hardware of the wireless terminal device. To improve confidentiality.

  More specifically, data information for encryption, decryption, and electronic signature is input from the first and second domains 110 and 120 (S201). Next, it is confirmed whether or not the wireless terminal device supports a hardware encryption operation function for the input data information (S202). If the hardware-like cryptographic operation function is supported, the cryptographic operation by hardware with high speed is performed (S203). If the hardware encryption operation function is not supported, the controller 300 using the VMM performs software encryption operation (S204). Next, the encrypted data is returned to the domains 110 and 120 that request the data information (S205).

  FIG. 5 is a flowchart for explaining an SMS / MMS data backup processing method of a wireless terminal device according to an embodiment of the present invention.

  As shown in FIG. 5, the present invention prevents the SMS / MMS message from being deleted or transformed by executing malicious code included in the SMS / MMS in the second domain 120. Is backed up to the third domain 130 other than the first and second domains 110 and 120.

  More specifically, the second domain 120 receives and executes the SMS / MMS (S301), and transmits and stores the SMS / MMS message to the third domain 130 (S302). At this time, the third domain 130 performs only the storage function without performing the backup data information in order to minimize the SMS / MMS runtime system damage including the malicious code and recover the data at the time of the accident. preferable.

  Although the embodiments of the present invention have been described with reference to the accompanying drawings, those who have ordinary knowledge in the technical field to which the present invention belongs do not change the technical idea or essential features of the present invention. It will be understood that the invention can be implemented in other specific forms. Accordingly, the embodiments described above are to be understood as illustrative in all aspects and not restrictive. The scope of the present invention is defined by the following claims rather than the above detailed description, and all modifications or variations derived from the meaning and scope of the claims and equivalents thereof are included in the scope of the present invention. Must be interpreted.

100 domain part 110 first domain 111 first application 112 first operating system (OS1)
120 second domain 121 second application 122 second operating system (OS2)
130 third domain 200 system resource unit 300 control unit 310 access control module 320 encryption module

Claims (5)

(A) calculating a current battery usage amount of a second domain that is separated from a first domain that drives the first application and that drives the second application, and a current battery remaining amount of the wireless terminal device;
(B) A step of interrupting the driving of the second domain if the current battery remaining amount of the wireless terminal device calculated in the step (a) is less than a minimum reference value for stably driving an important service. And (c) if the current battery residual amount of the wireless terminal device is greater than or equal to a minimum reference value in the step (b), and the current battery usage of the second domain is greater than or equal to a maximum reference value, A method of protecting a system of a wireless terminal device, comprising a step of gradually reducing CPU usage of a domain.   (D) further comprising performing encryption and decryption on important data information input from the first and second domains to a system resource unit constituting hardware of the wireless terminal device. The system protection method of the radio | wireless terminal apparatus of 1. In step (d),
(D1) inputting data information for encryption, decryption, and electronic signature from the first and second domains;
(D2) If the wireless terminal device supports a hardware encryption operation function for the data information input in the step (d1), the hardware operation is performed by performing encryption operation through hardware. If the encryption operation function is not supported, a step of performing a software encryption operation in the control unit using the VMM, and (d3) requesting the data information encrypted in the step (d2) The system protection method for a wireless terminal device according to claim 2, comprising a step of returning to the domain.   (E) In order to prevent the SMS / MMS message from being deleted or transformed by execution of malicious code included in the SMS / MMS in the second domain, the SMS / MMS message is transferred to the first and second domains. The system protection method for a wireless terminal device according to claim 2, further comprising a step of performing backup in a third domain classified as: In step (e),
5. The radio of claim 4, comprising: (e1) receiving and executing the SMS / MMS in the second domain; and (e2) transmitting and storing the SMS / MMS message in the third domain. Terminal device system protection method.

Images